Wirus z facebook

[anulka0902]

czesc. Własnie dopadł mnie, jak widze dobrze znany, wirus z facebook:/Dostałam jakis filmik na youtube i niestety sciagnelam tego wirusa na moj komputer. Kompletnie nie wiem co robic wiec bardzo prosze o szybka pomoc. Z góry dziękuje

Linki z OTL:

OTL.txt: http://wklej.to/xnPFv

extras.txt: http://wklej.to/oIAxZ

[Acorus]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL MOD - [2011-08-21 15:10:17 | 000,634,880 | ---- | M] () – C:\WINDOWS\update.2\svchost.exe MOD - [2011-08-21 13:40:11 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe MOD - [2011-08-21 13:39:32 | 000,348,672 | ---- | M] () – C:\WINDOWS\update.5.0\svchost.exe MOD - [2011-08-21 13:38:35 | 000,382,464 | ---- | M] () – C:\WINDOWS\update.7.1\svchostdriver.exe MOD - [2011-08-21 13:36:50 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe MOD - [2011-08-21 13:23:00 | 001,216,000 | -H-- | M] () – C:\WINDOWS\update.tray-2-0-lnk\svchost.exe MOD - [2011-08-21 13:23:00 | 001,216,000 | -H-- | M] () – C:\WINDOWS\update.tray-2-0\svchost.exe MOD - [2011-08-21 13:23:00 | 001,216,000 | -H-- | M] () – C:\WINDOWS\update.1\svchost.exe O4 - HKLM…\Run: [14995443-loader2.exe] C:\WINDOWS\TEMP\14995443-loader2.exe () O4 - HKLM…\Run: [2358599.exe] C:\Documents and Settings\user\Ustawienia lokalne\Temp\2358599.exe () O4 - HKLM…\Run: [3464987.exe] C:\WINDOWS\TEMP\3464987.exe () O4 - HKLM…\Run: [5769639.exe] C:\WINDOWS\TEMP\5769639.exe () O4 - HKLM…\Run: [8003096.exe] C:\WINDOWS\TEMP\8003096.exe () O4 - HKLM…\Run: [egui] File not found O4 - HKLM…\Run: [FixCamera] File not found O4 - HKLM…\Run: [l1rezerv.exe] C:\WINDOWS\l1rezerv.exe () O4 - HKLM…\Run: [sysdriver32.exe] C:\WINDOWS\sysdriver32.exe () O4 - HKLM…\Run: [sysdriver32_.exe] C:\WINDOWS\sysdriver32_.exe () O4 - HKLM…\Run: [tray_ico] File not found O4 - HKLM…\Run: [tray_ico0] C:\WINDOWS\update.tray-2-0\svchost.exe () O4 - HKLM…\Run: [tray_ico1] File not found O4 - HKLM…\Run: [tray_ico2] File not found O4 - HKLM…\Run: [tray_ico3] File not found O4 - HKLM…\Run: [tray_ico4] File not found O4 - HKLM…\Run: [wxpdrv] C:\WINDOWS\services32.exe () [2011-08-21 13:41:30 | 000,000,000 | —D | C] – C:\WINDOWS\ufa [2011-08-21 13:41:30 | 000,000,000 | —D | C] – C:\WINDOWS\rpcminer [2011-08-21 13:41:30 | 000,000,000 | —D | C] – C:\WINDOWS\phoenix [2011-08-21 13:39:33 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.5.0 [2011-08-21 13:38:56 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.2 [2011-08-21 13:38:36 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.7.1 [2011-08-21 13:36:26 | 000,000,000 | —D | C] – C:\WINDOWS\av_ico [2011-08-21 13:33:36 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.1 [2011-08-21 13:33:33 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-2-0-lnk [2011-08-21 13:33:33 | 000,000,000 | -H-D | C] – C:\WINDOWS\update.tray-2-0 [2011-08-21 15:47:23 | 000,000,179 | ---- | M] () – C:\WINDOWS\info1 [2011-08-21 15:10:47 | 000,000,734 | ---- | M] () – C:\WINDOWS\System32\drivers\etc\hîsts [2011-08-21 13:41:29 | 005,589,370 | ---- | M] () – C:\WINDOWS\phoenix.rar [2011-08-21 13:41:29 | 000,246,272 | ---- | M] () – C:\WINDOWS\unrar.exe [2011-08-21 13:41:29 | 000,182,617 | ---- | M] () – C:\WINDOWS\ufa.rar [2011-08-21 13:41:23 | 001,075,284 | ---- | M] () – C:\WINDOWS\rpcminer.rar [2011-08-21 13:40:11 | 000,232,960 | ---- | M] () – C:\WINDOWS\l1rezerv.exe [2011-08-21 13:37:47 | 000,904,792 | ---- | M] () – C:\WINDOWS\geoiplist.rar [2011-08-21 13:37:21 | 000,000,000 | ---- | M] () – C:\WINDOWS\loader2.exe_ok [2011-08-21 13:36:50 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32_.exe [2011-08-21 13:36:50 | 000,258,048 | ---- | M] () – C:\WINDOWS\sysdriver32.exe [2011-08-21 13:23:00 | 001,216,000 | ---- | M] () – C:\WINDOWS\services32.exe :Services srviecheck srvbtcclient ddservice srvsysdriver32 wxpdrivers :Reg [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot] “AlternateShell”=“cmd.exe” :Commands [emptytemp] [resethosts]

Kliknij Wykonaj skrypt…Zatwierdź restart komputera. Zapisz raport, który pokaże się po restarcie. Następnie uruchom OTL ponownie, tym razem kliknij (Skanuj).

Pokaż nowy log OTL.txt oraz raport z usuwania.

[anulka0902]

raport po wykonaniu skryptu: http://wklej.to/uZqgW

nowy OTL: http://wklej.to/lONud

[Acorus]

Uruchom OTL i w okno (Własne opcje skanowania/Script)wklej:

:OTL IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://search.imesh.com/ IE - HKCU…\URLSearchHook: {57BCA5FA-5DBB-45a2-B558-1755C3F6253B} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) FF - prefs.js…browser.search.defaultenginename: “iMesh Web Search” FF - prefs.js…browser.search.defaulturl: “http://slirsredirect.search.aol.com/slirs_http/sredir?sredir=2685&invocationType=tb50ffwinampie7&query=” FF - prefs.js…browser.search.order.1: “iMesh Web Search” FF - prefs.js…browser.startup.homepage: “http://search.imesh.com/” FF - prefs.js…keyword.URL: “http://search.imesh.com/web?src=ffb&systemid=1&q=” [2010-08-31 11:08:13 | 000,000,000 | —D | M] (Winamp Toolbar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\91ddawva.default\extensions{0b38152b-1b20-484d-a11f-5e04a9b0661f} [2010-09-28 19:46:38 | 000,000,000 | —D | M] (MediaBar) – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\91ddawva.default\extensions{28D35620-51D9-11DE-9D13-2DB156D89593} [2010-08-12 10:21:14 | 000,002,486 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\91ddawva.default\searchplugins\iMeshWebSearch.xml [2010-09-12 19:37:49 | 000,001,201 | ---- | M] () – C:\Documents and Settings\user\Dane aplikacji\Mozilla\Firefox\Profiles\91ddawva.default\searchplugins\winamp-search.xml [2011-06-27 15:06:23 | 000,000,000 | —D | M] (No name found) – C:\Program Files\Mozilla Firefox\extensions [2010-08-12 10:21:14 | 000,002,486 | ---- | M] () – C:\Program Files\mozilla firefox\searchplugins\iMeshWebSearch.xml O2 - BHO: (Winamp Toolbar Loader) - {25CEE8EC-5730-41bc-8B58-22DDC8AB8C20} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O2 - BHO: (UrlHelper Class) - {474597C5-AB09-49d6-A4D5-2E8D7341384E} - C:\Program Files\iMesh Applications\MediaBar\Datamngr\IEBHO.dll (iMesh, Inc) O2 - BHO: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll () O3 - HKLM…\Toolbar: (MediaBar) - {ABB49B3B-AB7D-4ED0-9135-93FD5AA4F69F} - C:\Program Files\iMesh Applications\MediaBar\ToolBar\iMeshMediaBarDx.dll () O3 - HKLM…\Toolbar: (Winamp Toolbar) - {EBF2BA02-9094-4c5a-858B-BB198F3D8DE2} - C:\Program Files\Winamp Toolbar\winamptb.dll (AOL LLC.) O4 - HKLM…\Run: [DATAMNGR] C:\Program Files\iMesh Applications\MediaBar\Datamngr\datamngrUI.exe (iMesh, Inc) [2011-08-21 21:11:19 | 000,000,302 | ---- | M] () – C:\WINDOWS\tasks\systems.job [2011-08-21 21:11:19 | 000,000,300 | ---- | M] () – C:\WINDOWS\tasks\fbagent.job [2011-08-21 21:11:18 | 000,000,284 | ---- | M] () – C:\WINDOWS\tasks\iMeshNAG.job [2011-08-21 13:37:48 | 004,636,907 | ---- | C] () – C:\WINDOWS\geoiplist :Commands [emptytemp]

Kliknij Wykonaj skrypt.W OTL użyj opcji Sprzątanie.Odinstaluj MediaBar,Winamp Toolbar.Przeskanuj progr.Malwarebytes Anti-Malware

http://www.dobreprogramy.pl/Malwarebyte … 13117.html

Przed skanowaniem wykonaj RĘCZNĄ AKTUALIZACJĘ BAZY WIRUSÓW

Zainstaluj aktualizacje do programow wskazanych przez: http://screen317.spywareinfoforum.org/SecurityCheck.exe jako out of date.

[anulka0902]

Komputer wyleczony - Dziękuje za pomoc:)